More Markets Exploit: $9.3M Drained From WFLOW Token

[_act_]

More is a DeFi lending protocol which was exploited recently. The hackers behind the exploit stole 15.5 million WFLOW ( which is approximately $9.3 million) from the mFlowWFLOW reserve.

According to where I read it, on-chain traces show stolen funds were moved and bridged off-chain, the team is investigating with no recovery announced, and market reaction pushed WFLOW down ~9% and FLOW ~8.7% to $0.0262.

https://cryptorank.io/news/feed/47fcc-more-markets-exploit-9-3m-drained-from-wflow-token

[asriloni]

It's all rooted from the vulnerability on minting contract of ankrFLOW liquid token. The vulnerability let attacker to mint ankrFLOW, then he supply it as collateral to borrow wflow. It's just the same attack with the previous Kelpdao hack where the hackers were minting so many unbacked tokens just to supply it as a collateral to withdraw the funds pooled.

At this point, i can only come to the solution if the liquid token minting should have done manually through use some verifications. Using contract for minting purpose is a very risky decision. I hope the developers will think to change their mechanism. So there will be no more attack to the contract to mint the liquid token, then used it as a collateral attack to the vault.

Decentralization is good, but human can't rely upon the contract that might have undiscovered vulnerability. Do we need to wait until dozens of projects get hacked by the same method? I hope the developers aware of this serious problem.

They have to solved this if they care to the people's money.

[Jostle]

If anything goes, this just shows that DeFi carries significantly more risks than it claims to have. In terms of comparison with CeFi, both carried risks but are of different nature.  "Not your keys, not your crypto" cannot be more true than now (hold your own coins in your own wallet and don't put them in any CeFi/DeFi).

[shinratensei_]

The number of drained was actually around $410k after the slippage and the real FLOW spot price which is around $0.025 - $0.026, their bot was spitting out wrong number at more than 20x current market price. Regardless, it makes me wonder why hackers always found a way to make unauthorized mint on these tokens, do these project never check their code twice? and how these lending platform keep allowing the shittiest token as their collateral is honestly baffling.

[$crypto$]

If anything goes, this just shows that DeFi carries significantly more risks than it claims to have. In terms of comparison with CeFi, both carried risks but are of different nature.  "Not your keys, not your crypto" cannot be more true than now (hold your own coins in your own wallet and don't put them in any CeFi/DeFi).

Previously there were claims that using DEX is much better than CEX which requires you KYC let alone those who want to remain anonymous, now it has changed slowly, DEX is increasingly continuing to be attacked, CEX is increasingly prone to blocking your assets.

There are both positives and negatives, stay yourself how to run it, I know a lot of people shy away but out there are still many people earning from DEX or CEX so they can't escape from this, one more thing is to be careful.

[JeromeTash]

Not surprised anymore. And anyone who still trusts these DeFi protocols ought to think twice again. Being open source does not mean the project is safe, and this includes smart contracts. I noticed that most of the open-source projects have been targeted lately, and who do you think the culprit is?

I say AI. It's helping the hackers do their job much more easily.

[Odohu]

If anything goes, this just shows that DeFi carries significantly more risks than it claims to have. In terms of comparison with CeFi, both carried risks but are of different nature.  "Not your keys, not your crypto" cannot be more true than now (hold your own coins in your own wallet and don't put them in any CeFi/DeFi).

This is absolutely correct; the risk is massive and often ignored. People have lost their livelihood to some of these DeFi infrastructures yet due to the hype no one is bold enough to say it as it is. I don't know if the boom in AI is the reason we are seeing too many successful hacks of what we used to know to be safe, but I still believe that self-custody still stands a chance against these new threats. I strongly discourage anyone who wants to trust these DeFi infrastructures even those that claim to be open source.

[jossiel]

The other thread[1] also reported the exploit through Cronos' network through tectonic. They have to halt the network for it to control and stop.

So, with this exploit in More. I guess that people will realize that these DeFi platforms are always hot in the eyes of these hackers. If you're a fan of it, you may earn more through their LPs but, the risk is too high.

[1] Cronos (Crypto.com) halts its entire blockchain

[cryptoaddictchie]

Decentralization is good, but human can't rely upon the contract that might have undiscovered vulnerability. Do we need to wait until dozens of projects get hacked by the same method? I hope the developers aware of this serious problem.

They have to solved this if they care to the people's money.

The only decentralized coin I ever known is likely bitcoin. When it comes to defi, yeah the concept is for decentralization however those devs are always had supply of these tokens and if not they magically have some tricks underneath the codes that can means potential breached or whatever sorcery that drained or scammed users.

As a user of defi, its always good to be cautious by not putting a huge chunk of liquidity especially if its a new platform with shallow security done.

[ultrloa]

Decentralization is good, but human can't rely upon the contract that might have undiscovered vulnerability. Do we need to wait until dozens of projects get hacked by the same method? I hope the developers aware of this serious problem.

They have to solved this if they care to the people's money.

The only decentralized coin I ever known is likely bitcoin. When it comes to defi, yeah the concept is for decentralization however those devs are always had supply of these tokens and if not they magically have some tricks underneath the codes that can means potential breached or whatever sorcery that drained or scammed users.

As a user of defi, its always good to be cautious by not putting a huge chunk of liquidity especially if its a new platform with shallow security done.

The only coin I believe which is truly decentralized, since there's no single institution controls it.

Also yeah we those Defi is actually built on the idea about decentralization. but the real situation happening out there is, their developer still have control with their tokens. Because they can do anything they like to happen with their creation.

This is the reason why we should take extra precautionary measure when dealing with those alts. Also don't put huge money, because either they might experience hacking due to possible weak security features in their site or the owner might scam them, its not new to see a rug pulls and this is common on new altcoins.

[cryptoaddictchie]

This is the reason why we should take extra precautionary measure when dealing with those alts. Also don't put huge money, because either they might experience hacking due to possible weak security features in their site or the owner might scam them, its not new to see a rug pulls and this is common on new altcoins.

As a risk taker myself I probably engage with more than 50 to 100 defis in the web3 and so far Im just lucky that I didnt experienced being part of the hack or breach from a hacker. Maybe except the case of terra, which not sure if considered as hack or insider move which I bled a lot for holding the stablecoin they run and turn close to 0 value.

When dealing with new defi platform, make sure youre ready for cases like this cause theres a chance theres no saving of the loss if ever the unwanted happened badly. Same like when apeing on memecoin which code might be tricky and has a malicious set up.

[JeromeTash]

When dealing with new defi platform, make sure youre ready for cases like this cause theres a chance theres no saving of the loss if ever the unwanted happened badly. Same like when apeing on memecoin which code might be tricky and has a malicious set up.

it's more like a gambling thing. You hit or miss 
I traded memecoins for some time, and all I can say is that things kept going worse and worse. Where from, for every 1 genuine memecoin, there were like 100 or so scam memecoins. I stopped trading them while I was still in profit thanks to one very awesome coin that pumped, but what I remember is that my last 10 trades were just losses.

[cryptoaddictchie]

it's more like a gambling thing. You hit or miss 
I traded memecoins for some time, and all I can say is that things kept going worse and worse. Where from, for every 1 genuine memecoin, there were like 100 or so scam memecoins. I stopped trading them while I was still in profit thanks to one very awesome coin that pumped, but what I remember is that my last 10 trades were just losses.

Thats true I guess thats the real ratio when doing memecoin 1 out of 100 will be the only legit one and the rest are all scam or rugged projects. But in memecoin, if ever you hit early a good one by random chance then the profit is surely huge. Everyone trading in memecoin especially the newbies should expect this already.

Like when I ape on certain coins I already think of those money are loss upon execution. Its literally a gamble and if your heart is faint on those kind then dont do it.